IBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks

https://www.securityweek.com/wp-content/uploads/2025/07/CISA-KEV.jpg

The Cybersecurity and Infrastructure Security Agency (CISA) on Monday warned that threat actors have been exploiting fresh IBM Aspera Faspex and SignalWire FreeSwitch vulnerabilities in attacks.

The Faspex flaw, tracked as CVE-2026-123218 (CVSS score of 9.8), is an authorization bypass that can be exploited via crafted messages. Successful exploitation could allow authenticated users to gain full administrative privileges.

IBM patched the security defect on Friday in Aspera Faspex version 5.0.19 PL1, urging customers to update their deployments as soon as possible.

Tracked as CVE-2026-116779 (CVSS score of 9.8), the SignalWire FreeSwitch bug is described as a code injection issue leading to sensitive information disclosure, arbitrary call control, and command execution.

The root cause of the weakness is a function that splits the ‘To’ user of an inbound SIP MESSAGE when encountering a plus (+) sign, while treating the left side as a chat protocol selector.

Because the chat layer allows...

Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE

Read more